SSO Clients Groups

Download OpenAPI specification:Download

Configure Mosaic SSO Service to streamline login for users. Create and manage SSO clients group to control your SSO login experience.

Create clients group

Creates a new SSO clients group.

Required permissions: sso-service:edit.

SecurityOAuth2: ClientAccessToken
Request
Request Body schema: application/json
required
name
required
string

Name of the clients group

description
string

Short description of the clients group

required
object

Configuration of the clients group

Responses
201
post/v1/sso-service/sso-group
Request samples
application/json
{
  • "name": "My Clients Group",
  • "description": "string",
  • "configuration": {
    }
}
Response samples
application/json
{
  • "result": {
    }
}

Get all clients groups

Retrieves a list of all clients groups.

Required permissions: sso-service:read.

SecurityOAuth2: ClientAccessToken
Responses
200
get/v1/sso-service/sso-group
Request samples 
Response samples 
application/json
{
  • "result": [
    ]
}
Get clients group by ID
Retrieves a clients group by its ID. The clients group ID is a unique identifier for a clients group. 

Required permissions: sso-service:read.


SecurityOAuth2: ClientAccessToken 
Request 
path Parameters
groupId
required
string
ID of the group to retrieve


 
Responses 
200
404
SSO Service Not Found


get/v1/sso-service/sso-group/{groupId}
Request samples 
Response samples 
application/json
{
  • "result": {
    }
}
Update clients group
Updates an existing clients group. The clients group ID is a unique identifier for a clients group. 

Required permissions: sso-service:edit.


SecurityOAuth2: ClientAccessToken 
Request 
path Parameters
groupId
required
string
ID of the group to retrieve


 
Request Body schema: application/json
required
name
required
string
Name of the clients group


 
description
string
Short description of the clients group


 
required
object
Configuration of the clients group


 
Responses 
404
put/v1/sso-service/sso-group/{groupId}
Request samples 
application/json
{
  • "name": "My Clients Group",
  • "description": "string",
  • "configuration": {
    }
}
Response samples 
application/json
{ }
Delete clients group
Deletes a clients group. 

Required permissions: sso-service:edit, sso-service:delete.


SecurityOAuth2: ClientAccessToken 
Request 
path Parameters
groupId
required
string
ID of the group to retrieve


 
Responses 
204
Clients group deleted


delete/v1/sso-service/sso-group/{groupId}
Request samples 
Create SSO group client
Creates a new client in the SSO clients group. 

Required permissions: sso-service:edit.


SecurityOAuth2: ClientAccessToken 
Request 
path Parameters
groupId
required
string
ID of the group to retrieve


 
Request Body schema: application/json
required
Any of:
name
required
string
Name of the client


 
description
string
Short description of the client


 
resources
Array of strings
List of resources IDs associated with this client


 
authentication_protocol
string
 Default:  "oidc"
Authentication protocol used by the client


 Enum: "oidc" "saml"  
client_group_id
string
Id of client group to associate with


 
default_custom_claims
Array of strings
List of client default custom claims


Items Enum: "tid" "fname" "lname" "mname" "email" "email_verified" "phone_number" "phone_number_verified" "groups" "new_user" "birthday" "language" "city" "address" "country" "street_address" "address_type" "webauthn" "roles" "ts_roles" "role_values" "ts_permissions" "permissions" "approval_data" "custom_group_data" "username" "secondary_phone_numbers" "secondary_emails" "picture" "created_at" "last_auth" "auth_time" "external_account_id" "external_user_id" "app_name" "custom_data" "custom_app_data"  
short_cookies_samesite_type
string
 Default:  "lax"
Short cookies samesite type. Possible values: "none", "lax", "strict". Default: "lax"


 Enum: "lax" "none"  
redirect_uris
required
Array of strings
List of URIs approved for redirects for your client


 
client_type
string
 Default:  "web"
Client type


 Enum: "web" "native"  
response_types
Array of strings
 Default:  ["code","id_token"]
Items Enum: "code" "id_token"  
token_endpoint_auth_method
string
 Deprecated 
 Default:  "client_secret_basic"
This field is deprecated- to configure pkce use "pkce" field instead


 Enum: "client_secret_basic" "self_signed_tls_client_auth" "tls_client_auth" "none" "private_key_jwt"  
object
Configuration for an OAuth Device Authorization Flow


 
object
CIBA authorization flow configuration


 
pkce
string
PKCE configuration


 Enum: "enforcePkceInsteadOfClientCredentials" "enforcePkceAlongsideClientCredentials" "allowPkceAlongsideClientCredentials"  
supported_prompts
Array of strings
Supported prompts for the OIDC authentication flow


Items Enum: "login" "consent" "none"  
object
Token expiration settings


 
session_expiration
number
Session expiration time (seconds)


 
enforce_par
boolean
enforce PAR (Pushed Authorization Request) for this client


 
role_ids
Array of strings
Role IDs


 
fapi_version_compliancy
boolean
FAPI 2.0 compliancy configuration


 
Responses 
201
409
post/v1/sso-service/sso-group/{groupId}/clients
Request samples 
application/json
{
  • "name": "My Client",
  • "description": "string",
  • "resources": [
    ],
  • "authentication_protocol": "oidc",
  • "client_group_id": "string",
  • "default_custom_claims": [
    ],
  • "short_cookies_samesite_type": "lax",
  • "redirect_uris": [],
  • "client_type": "web",
  • "response_types": [
    ],
  • "token_endpoint_auth_method": "client_secret_basic",
  • "device_authorization": {},
  • "ciba_authorization": {},
  • "pkce": "enforcePkceInsteadOfClientCredentials",
  • "supported_prompts": [
    ],
  • "token_expiration": {
    },
  • "session_expiration": 0,
  • "enforce_par": true,
  • "role_ids": [
    ],
  • "fapi_version_compliancy": true
}
Response samples 
application/json
{
  • "result": {
    }
}
Update client
Updates a client within the SSO clients group by specifying it by its ID. Note: Fields that are objects cannot be partially updated, since the new value you set will just replace the current one. 

Required permissions: sso-service:edit.


SecurityOAuth2: ClientAccessToken 
Request 
path Parameters
groupId
required
string
ID of the group to retrieve


 
clientId
required
string
ID of the client to retrieve


 
Request Body schema: application/json
required
Any of:
name
string
Name of the client


 
description
string
Short description of the client


 
resources
Array of strings
List of resources IDs associated with this client


 
client_group_id
string
Id of client group to associate with


 
default_custom_claims
Array of strings
List of client default custom claims


Items Enum: "tid" "fname" "lname" "mname" "email" "email_verified" "phone_number" "phone_number_verified" "groups" "new_user" "birthday" "language" "city" "address" "country" "street_address" "address_type" "webauthn" "roles" "ts_roles" "role_values" "ts_permissions" "permissions" "approval_data" "custom_group_data" "username" "secondary_phone_numbers" "secondary_emails" "picture" "created_at" "last_auth" "auth_time" "external_account_id" "external_user_id" "app_name" "custom_data" "custom_app_data"  
short_cookies_samesite_type
string
 Default:  "lax"
Short cookies samesite type. Possible values: "none", "lax", "strict". Default: "lax"


 Enum: "lax" "none"  
redirect_uris
Array of strings
List of URIs approved for redirects for your client


 
client_type
string
 Default:  "web"
Client type


 Enum: "web" "native"  
response_types
Array of strings
 Default:  ["code","id_token"]
Items Enum: "code" "id_token"  
token_endpoint_auth_method
string
 Deprecated 
 Default:  "client_secret_basic"
This field is deprecated- to configure pkce use "pkce" field instead


 Enum: "client_secret_basic" "self_signed_tls_client_auth" "tls_client_auth" "none" "private_key_jwt"  
object
Configuration for an OAuth Device Authorization Flow


 
object
CIBA authorization flow configuration


 
pkce
string
PKCE configuration


 Enum: "enforcePkceInsteadOfClientCredentials" "enforcePkceAlongsideClientCredentials" "allowPkceAlongsideClientCredentials"  
supported_prompts
Array of strings
Supported prompts for the OIDC authentication flow


Items Enum: "login" "consent" "none"  
object
Token expiration settings


 
session_expiration
number
Session expiration time (seconds)


 
enforce_par
boolean
enforce PAR (Pushed Authorization Request) for this client


 
role_ids
Array of strings
Role IDs


 
fapi_version_compliancy
boolean
FAPI 2.0 compliancy configuration


 
Responses 
200
404
put/v1/sso-service/sso-group/{groupId}/clients/{clientId}
Request samples 
application/json
{
  • "name": "My Client",
  • "description": "string",
  • "resources": [
    ],
  • "client_group_id": "string",
  • "default_custom_claims": [
    ],
  • "short_cookies_samesite_type": "lax",
  • "redirect_uris": [],
  • "client_type": "web",
  • "response_types": [
    ],
  • "token_endpoint_auth_method": "client_secret_basic",
  • "device_authorization": {},
  • "ciba_authorization": {},
  • "pkce": "enforcePkceInsteadOfClientCredentials",
  • "supported_prompts": [
    ],
  • "token_expiration": {
    },
  • "session_expiration": 0,
  • "enforce_par": true,
  • "role_ids": [
    ],
  • "fapi_version_compliancy": true
}
Response samples 
application/json
{
  • "result": {
    }
}
Delete client
Deletes a client and removes it from the SSO client group. 

Required permissions: sso-service:edit, sso-service:delete.


SecurityOAuth2: ClientAccessToken 
Request 
path Parameters
groupId
required
string
ID of the group to retrieve


 
clientId
required
string
ID of the client to delete


 
Responses 
204
404
delete/v1/sso-service/sso-group/{groupId}/clients/{clientId}
Request samples 
Response samples 
application/json
{
  • "message": "string",
  • "error_code": 404
}